Technique ID,Detection Available,Link,score
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
T1055.011,No,-,0
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,5
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,5
T1066,No,-,0
T1560.001,No,-,0
T1021.005,No,-,0
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,5
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5
T1156,No,-,0
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1067,No,-,0
T1037,No,-,0
T1557,No,-,0
T1033,No,-,0
T1583,No,-,0
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8
T1143,No,-,0
T1161,No,-,0
T1132.001,No,-,0
T1150,No,-,0
T1556.003,No,-,0
T1578.004,No,-,0
T1148,No,-,0
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4
T1596.003,No,-,0
T1056.001,No,-,0
T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,28
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,28
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
T1498.001,No,-,0
T1492,No,-,0
T1574.007,No,-,0
T1213.002,No,-,0
T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
T1590.005,No,-,0
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
T1059.007,No,-,0
T1590.002,No,-,0
T1501,No,-,0
T1514,No,-,0
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1543,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
T1133,No,-,0
T1109,No,-,0
T1546.006,No,-,0
T1539,No,-,0
T1568.002,No,-,0
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
T1099,No,-,0
T1548.003,No,-,0
T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,0
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
T1069.003,No,-,0
T1574.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,1
T1596.001,No,-,0
T1499.003,No,-,0
T1163,No,-,0
T1195.001,No,-,0
T1588.004,No,-,0
T1583.002,No,-,0
T1561,No,-,0
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2
T1552.005,No,-,0
T1555.002,No,-,0
T1542.003,No,-,0
T1025,No,-,0
T1116,No,-,0
T1522,No,-,0
T1093,No,-,0
T1074.001,No,-,0
T1036.005,No,-,0
T1172,No,-,0
T1587.003,No,-,0
T1565.001,No,-,0
T1110.002,No,-,0
T1178,No,-,0
T1114.001,No,-,0
T1555.001,No,-,0
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5
T1003.004,No,-,0
T1013,No,-,0
T1600,No,-,0
T1606.002,No,-,0
T1192,No,-,0
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
T1087.002,No,-,0
T1564,No,-,1
T1559.002,No,-,0
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,3
T1591.003,No,-,0
T1063,No,-,0
T1592.001,No,-,0
T1080,No,-,0
T1484.002,No,-,0
T1573.001,No,-,0
T1087.001,No,-,0
T1167,No,-,0
T1586.001,No,-,0
T1527,No,-,0
T1180,No,-,0
T1542.005,No,-,0
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1
T1568.001,No,-,0
T1497.001,No,-,0
T1053.003,No,-,0
T1069.002,No,-,0
T1588.006,No,-,0
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,1
T1165,No,-,0
T1070.002,No,-,0
T1499.004,No,-,0
T1137,No,-,0
T1218.004,No,-,0
T1598.003,No,-,0
T1021.004,No,-,0
T1098.003,No,-,0
T1547.012,No,-,0
T1089,No,-,0
T1487,No,-,0
T1566.001,No,-,0
T1214,No,-,0
T1559.001,No,-,0
T1574.001,No,-,0
T1119,No,-,0
T1115,No,-,0
T1003.007,No,-,0
T1583.005,No,-,0
T1103,No,-,0
T1553.001,No,-,0
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1040,No,-,0
T1017,No,-,0
T1553.002,No,-,0
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2
T1565.003,No,-,0
T1552.002,No,-,0
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1120,No,-,0
T1590.004,No,-,0
T1587.002,No,-,0
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1
T1137.006,No,-,0
T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,9
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1498.002,No,-,0
T1556.002,No,-,0
T1059.002,No,-,0
T1176,No,-,0
T1499.002,No,-,0
T1195.003,No,-,0
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1558.004,No,-,0
T1058,No,-,0
T1584.003,No,-,0
T1600.001,No,-,0
T1070.003,No,-,0
T1202,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1024,No,-,0
T1536,No,-,0
T1091,No,-,0
T1005,No,-,0
T1140,No,-,0
T1137.005,No,-,0
T1562,No,-,9
T1586.002,No,-,0
T1195,No,-,0
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,3
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,3
T1567,No,-,0
T1219,No,-,0
T1583.001,No,-,0
T1560.002,No,-,0
T1055.003,No,-,0
T1079,No,-,0
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,9
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,9
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,9
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
T1218,No,-,26
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
T1070.006,No,-,0
T1547.009,No,-,0
T1010,No,-,0
T1032,No,-,0
T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
T1218.003,No,-,0
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
T1599.001,No,-,0
T1547.005,No,-,0
T1004,No,-,0
T1009,No,-,0
T1550,No,-,2
T1076,No,-,0
T1597.001,No,-,0
T1011,No,-,0
T1602.002,No,-,0
T1589,No,-,1
T1131,No,-,0
T1181,No,-,0
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,2
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,2
T1560,No,-,0
T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,2
T1207,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,2
T1107,No,-,0
T1145,No,-,0
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,2
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,2
T1543.004,No,-,0
T1580,No,-,0
T1555.003,No,-,0
T1574.008,No,-,0
T1491,No,-,0
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_in_previously_unused_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8
T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8
T1155,No,-,0
T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
T1027.001,No,-,0
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1
T1484.001,No,-,0
T1217,No,-,0
T1552.004,No,-,0
T1583.004,No,-,0
T1021.006,No,-,0
T1011.001,No,-,0
T1078.001,No,-,0
T1547.003,No,-,0
T1183,No,-,0
T1085,No,-,0
T1031,No,-,0
T1546.005,No,-,0
T1574.006,No,-,0
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,3
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,3
T1092,No,-,0
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,2
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,2
T1585.002,No,-,0
T1557.001,No,-,0
T1222,No,-,1
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10
T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
T1110.003,No,-,0
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
T1164,No,-,0
T1054,No,-,0
T1108,No,-,0
T1193,No,-,0
T1003.005,No,-,0
T1098.004,No,-,0
T1215,No,-,0
T1101,No,-,0
T1590.006,No,-,0
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,1
T1218.008,No,-,0
T1593.002,No,-,0
T1177,No,-,0
T1591.002,No,-,0
T1125,No,-,0
T1144,No,-,0
T1045,No,-,0
T1055.013,No,-,0
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,1
T1578.003,No,-,0
T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1090,No,-,0
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1558.001,No,-,0
T1175,No,-,0
T1020,No,-,0
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_bypass_mfa_via_trusted_ip.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_network_acl_activity.yml,4
T1036.002,No,-,0
T1588.001,No,-,0
T1542.002,No,-,0
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,5
T1048.001,No,-,0
T1137.001,No,-,0
T1583.003,No,-,0
T1213.001,No,-,0
T1550.003,No,-,0
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1568,No,-,0
T1036.004,No,-,0
T1055.004,No,-,0
T1020.001,No,-,0
T1138,No,-,0
T1546.009,No,-,0
T1191,No,-,0
T1188,No,-,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,2
T1074,No,-,0
T1049,No,-,0
T1584,No,-,0
T1600.002,No,-,0
T1542,No,-,0
T1064,No,-,0
T1051,No,-,0
T1055.002,No,-,0
T1218.012,No,-,0
T1586,No,-,0
T1569.001,No,-,0
T1584.005,No,-,0
T1059.008,No,-,0
T1552.003,No,-,0
T1497,No,-,0
T1102,No,-,0
T1552.001,No,-,0
T1568.003,No,-,0
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,6
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,6
T1104,No,-,0
T1480,No,-,0
T1606.001,No,-,0
T1134.001,No,-,0
T1567.001,No,-,0
T1205.001,No,-,0
T1583.006,No,-,0
T1528,No,-,0
T1598.002,No,-,0
T1098.001,No,-,0
T1204,No,-,3
T1491.001,No,-,0
T1564.002,No,-,0
T1134.003,No,-,0
T1552.006,No,-,0
T1196,No,-,0
T1048.002,No,-,0
T1087.004,No,-,0
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1562.003,No,-,0
T1053.004,No,-,0
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,1
T1596.004,No,-,0
T1497.002,No,-,0
T1141,No,-,0
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1041,No,-,0
T1134.004,No,-,0
T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1060,No,-,0
T1606,No,-,0
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1554,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,9
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,9
T1023,No,-,0
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1
T1055.014,No,-,0
T1026,No,-,0
T1071.002,No,-,0
T1122,No,-,0
T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
T1534,No,-,0
T1169,No,-,0
T1574.010,No,-,0
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3
T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3
T1069.001,No,-,0
T1149,No,-,0
T1593,No,-,0
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,12
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,12
T1170,No,-,0
T1048,No,-,4
T1547.006,No,-,0
T1056.002,No,-,0
T1097,No,-,0
T1588.002,No,-,0
T1052.001,No,-,0
T1597,No,-,0
T1053.006,No,-,0
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3
T1061,No,-,0
T1542.004,No,-,0
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3
T1565,No,-,0
T1559,No,-,0
T1001,No,-,0
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1584.006,No,-,0
T1601,No,-,0
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4
T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4
T1027.005,No,-,0
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42
T1571,No,-,0
T1585.001,No,-,0
T1073,No,-,0
T1055.012,No,-,0
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
T1154,No,-,0
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1546,No,-,7
T1546.004,No,-,0
T1187,No,-,0
T1134.005,No,-,0
T1599,No,-,0
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,4
T1488,No,-,0
T1553,No,-,1
T1548.004,No,-,0
T1592.003,No,-,0
T1573,No,-,0
T1174,No,-,0
T1547.002,No,-,0
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2
T1002,No,-,0
T1081,No,-,0
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1128,No,-,0
T1056,No,-,0
T1587.004,No,-,0
T1593.001,No,-,0
T1546.015,No,-,0
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6
T1102.002,No,-,0
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1
T1137.004,No,-,0
T1573.002,No,-,0
T1567.002,No,-,0
T1570,No,-,0
T1574.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1
T1168,No,-,0
T1166,No,-,0
T1037.005,No,-,0
T1100,No,-,0
T1186,No,-,0
T1184,No,-,0
T1095,No,-,0
T1075,No,-,0
T1027.003,No,-,0
T1584.002,No,-,0
T1001.003,No,-,0
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1030,No,-,0
T1028,No,-,0
T1550.004,No,-,0
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6
T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6
T1034,No,-,0
T1506,No,-,0
T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1
T1037.003,No,-,0
T1499,No,-,0
T1027.004,No,-,0
T1065,No,-,0
T1564.007,No,-,0
T1197,No,-,0
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3
T1088,No,-,0
T1494,No,-,0
T1090.004,No,-,0
T1557.002,No,-,0
T1562.008,No,-,0
T1518.001,No,-,0
T1564.003,No,-,0
T1493,No,-,0
T1059.006,No,-,0
T1591.004,No,-,0
T1132,No,-,0
T1546.010,No,-,0
T1598,No,-,0
T1496,No,-,0
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,1
T1588,No,-,0
T1546.002,No,-,0
T1147,No,-,0
T1578.002,No,-,0
T1500,No,-,0
T1565.002,No,-,0
T1003.008,No,-,0
T1543.001,No,-,0
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,2
T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,2
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,5
T1055.009,No,-,0
T1223,No,-,0
T1601.001,No,-,0
T1558.002,No,-,0
T1213,No,-,0
T1146,No,-,0
T1519,No,-,0
T1194,No,-,0
T1200,No,-,0
T1505,No,-,1
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2
T1132.002,No,-,0
T1556.001,No,-,0
T1537,No,-,0
T1130,No,-,0
T1022,No,-,0
T1070.004,No,-,0
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1
T1498,No,-,0
T1595.001,No,-,0
T1158,No,-,0
T1221,No,-,0
T1037.004,No,-,0
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,4
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,4
T1209,No,-,0
T1111,No,-,0
T1159,No,-,0
T1027.002,No,-,0
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1
T1059.005,No,-,0
T1564.005,No,-,0
T1543.002,No,-,0
T1563.002,No,-,0
T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7
T1584.004,No,-,0
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2
T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2
T1151,No,-,0
T1018,No,-,0
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,1
T1538,No,-,0
T1055.005,No,-,0
T1036.006,No,-,0
T1547.007,No,-,0
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,2
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2
T1052,No,-,0
T1574.002,No,-,0
T1105,No,-,0
T1098.002,No,-,0
T1588.003,No,-,0
T1126,No,-,0
T1084,No,-,0
T1160,No,-,0
T1055.008,No,-,0
T1021.001,No,-,0
T1037.001,No,-,0
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
T1220,No,-,0
T1596.005,No,-,0
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1
T1578.001,No,-,0
T1591.001,No,-,0
T1137.002,No,-,0
T1587,No,-,0
T1173,No,-,0
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
T1602.001,No,-,0
T1001.002,No,-,0
T1204.001,No,-,0
T1550.001,No,-,0
T1547.008,No,-,0
T1569.002,No,-,0
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15
T1480.001,No,-,0
T1008,No,-,0
T1564.004,No,-,0
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1096,No,-,0
T1003.006,No,-,0
T1124,No,-,0
T1053.002,No,-,0
T1035,No,-,0
T1055.001,No,-,0
T1086,No,-,0
T1588.005,No,-,0
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,3
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,3
T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,3
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
T1216,No,-,0
T1094,No,-,0
T1102.001,No,-,0
T1118,No,-,0
T1001.001,No,-,0
T1598.001,No,-,0
T1043,No,-,0
T1584.001,No,-,0
T1505.001,No,-,0
T1556.004,No,-,0
T1561.001,No,-,0
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,4
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,4
T1574.004,No,-,0
T1601.002,No,-,0
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,1
T1211,No,-,0
T1127,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_usage.yml,4
T1529,No,-,0
T1077,No,-,0
T1574.012,No,-,0
